UMA telecon 2011-11-03
Date and Time
- WG telecon on Thursday, 3 Nov 2011, at 9am PT (time chart) – NOTE: UK and Europe have changed their clocks so this will appear one hour earlier than usual to participants in those locations
- Skype line "C": +9900827042954214
- US: +1-201-793-9022 (other int'l numbers) | Room Code: 295-4214
Agenda
- Roll call
- Approve minutes of 2011-10-13, 2011-10-20, and 2011-10-27 meetings
- Action item review
- Review 2011Q4 timeline
- Edits from last week made?
- Contributing rev 02 update of I-D?
- Webinar planning: Doodle poll results?
- UMA core spec issues
- Attempt to solve #8, #14 through #17, and #24 expeditiously
- Other issues are bonus
- AOB
Attendees
- Bryan, Paul (chair pro tem)
- Hardjono, Thomas
- Alam
- Catalano, Domenico
- Morrow, Susan
- Szpot, Jacek
- Moren, Lukasz
- Machulak, Maciej
Minutes
Roll call
Quorum was reached.
Deferred.
Review 2011Q4 timeline
- Thomas attended Kerberos conference at MIT; will be working on next Internet-Draft this week.
- Paul planning on starting spin-off REST API Internet-Draft this week. Brief discussion re: relying on other Internet-Drafts, renewals, etc.
Upcoming webinar
- Reminder to everyone please participate in the Doodle Poll for best date/time to host the next UMA webinar.
- General agreement that Maciej should perform the demo, so need to confirm his participation.
UMA core spec issues
- Paul: Short answer: no, tokens are opaque.
- Paul: Longer answer: As long as tokens are opaque, expiration field is not necessary. This will change if/when we support tokens with semantics that host can use to make authorization decision. If/when we get to this point, we'll also possibly need other PKI-ish functions such as signature verification and token revocation mechanism.
- Paul takes AI to comment on this ticket in GitHub and close issue.
- Deferring for discussion next week.
- Paul: Short answer: no.
- Paul: Longer answer: as, discussed last week: UMA is focused on discretionary access control (DAC). Mandatory access control (MAC) is out of UMA scope. Host SHOULD give access if the requester has suitable permission. Discretionary access control should not override mandatory access controls.
- Paul takes AI to comment on this ticket in GitHub, modify the spec to SHOULD, and close the issue.
- Paul takes AI to discuss with Eve in more detail and comment on the ticket.
- Thomas takes AI to include the OpenID Connect simple JSON-based claims model
- Paul: Short answer: no.
- Paul: Longer answer: AM provides advice to host, and is not direct party to the interaction between requester and host.
- Paul takes AI to comment on ticket in GitHub.
- Paul: Short answer: no.
- Paul: Longer answer: There is no testable way we can require the AM to ask for only the claims actually needed in making an authorization decision, because:
- policies are intentionally opaque to requester and host
- there is no known automated way to test the reasonableness of requested claims for a given permission
- Paul takes AI to comment on ticket in GitHub.
Next Meetings
- WG telecon on Thursday, 10 Nov 2011, at 9am PT (time chart) – NOTE: back in sync on most apparent time differences around the world – ALSO NOTE: – Eve regrets; who will serve as chair pro tem?
- WG telecon on Thursday, 17 Nov 2011, at 9am PT (time chart) – NOTE: Likely Eve regrets; who will serve as chair pro tem?
- NO WG telecon on Thursday, 24 Nov 2011 – U.S. Thanksgiving holiday
- WG telecon on Thursday, 1 Dec 2011, at 9am PT (time chart)